dcrat | c0bea0a11853ecbdd169b0d0ac30f0afcba308555752a0ead4de45895ec69ed2

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2023, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0bea0a11853ecbdd169b0d0a.exe
Size

1.2MB
MD5

f20c74f02de55472d8b565868a19f4f5
SHA1

7be531a0a8ca1e686e6f7ff70fc3c2de963684fe
SHA256

c0bea0a11853ecbdd169b0d0ac30f0afcba308555752a0ead4de45895ec69ed2
SHA512

bd0664c6bb354ea240f942f8911daf494e62f97af6253ae77768b8d206e4c3245af655da94af410816917c1f7293123bc4dafa1ec8cc57fc1b5506fe5b3bebef
SSDEEP

24576:U2G/nvxW3Ww0t1Qo4QruJTrTn5mC8IasJ8lkf6LgH:UbA301n47rzrJfkY

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3324	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	4268	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	4268	schtasks.exe	83

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00080000000231d1-143.dat	dcrat
behavioral2/files/0x00080000000231d1-144.dat	dcrat
behavioral2/memory/2456-145-0x00000000009E0000-0x0000000000AD2000-memory.dmp	dcrat
behavioral2/files/0x00060000000231e5-148.dat	dcrat
behavioral2/files/0x0006000000023217-190.dat	dcrat
behavioral2/files/0x0006000000023217-189.dat	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	perfCrt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	c0bea0a11853ecbdd169b0d0a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2456	perfCrt.exe
1852	services.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\ModifiableWindowsApps\OfficeClickToRun.exe	perfCrt.exe
File created	C:\Program Files\7-Zip\Lang\cmd.exe	perfCrt.exe
File created	C:\Program Files\7-Zip\Lang\ebf1f9fa8afd6d	perfCrt.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\__tmp_rar_sfx_access_check_240631515	c0bea0a11853ecbdd169b0d0a.exe
File opened for modification	C:\Windows\xpdAC628S.bat	c0bea0a11853ecbdd169b0d0a.exe
File opened for modification	C:\Windows\perfCrt.exe	c0bea0a11853ecbdd169b0d0a.exe
File created	C:\Windows\8NQktCoAZviY5dhjarDv0yXqzR5kC.vbe	c0bea0a11853ecbdd169b0d0a.exe
File created	C:\Windows\Globalization\Sorting\dllhost.exe	perfCrt.exe
File created	C:\Windows\schemas\Provisioning\088424020bedd6	perfCrt.exe
File created	C:\Windows\Globalization\Sorting\5940a34987c991	perfCrt.exe
File created	C:\Windows\rescache\_merged\3970336390\SearchApp.exe	perfCrt.exe
File created	C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\explorer.exe	perfCrt.exe
File created	C:\Windows\schemas\Provisioning\conhost.exe	perfCrt.exe
File created	C:\Windows\Offline Web Pages\perfCrt.exe	perfCrt.exe
File created	C:\Windows\xpdAC628S.bat	c0bea0a11853ecbdd169b0d0a.exe
File created	C:\Windows\perfCrt.exe	c0bea0a11853ecbdd169b0d0a.exe
File opened for modification	C:\Windows\8NQktCoAZviY5dhjarDv0yXqzR5kC.vbe	c0bea0a11853ecbdd169b0d0a.exe
File created	C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\7a0fd90576e088	perfCrt.exe
File created	C:\Windows\Offline Web Pages\66992792adb75e	perfCrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3324	schtasks.exe
4892	schtasks.exe
1736	schtasks.exe
628	schtasks.exe
4824	schtasks.exe
4764	schtasks.exe
4972	schtasks.exe
444	schtasks.exe
4084	schtasks.exe
944	schtasks.exe
1352	schtasks.exe
1876	schtasks.exe
4228	schtasks.exe
3052	schtasks.exe
3964	schtasks.exe
640	schtasks.exe
1248	schtasks.exe
4248	schtasks.exe
784	schtasks.exe
4340	schtasks.exe
1468	schtasks.exe
2040	schtasks.exe
3388	schtasks.exe
4184	schtasks.exe
848	schtasks.exe
2216	schtasks.exe
4556	schtasks.exe
1640	schtasks.exe
4360	schtasks.exe
2072	schtasks.exe
2252	schtasks.exe
2592	schtasks.exe
2164	schtasks.exe
1328	schtasks.exe
2940	schtasks.exe
2740	schtasks.exe
3848	schtasks.exe
5028	schtasks.exe
3732	schtasks.exe
4996	schtasks.exe
4560	schtasks.exe
1572	schtasks.exe
536	schtasks.exe
2152	schtasks.exe
1856	schtasks.exe
804	schtasks.exe
3096	schtasks.exe
1664	schtasks.exe
1688	schtasks.exe
2124	schtasks.exe
1556	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings	c0bea0a11853ecbdd169b0d0a.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2456	perfCrt.exe
2456	perfCrt.exe
2456	perfCrt.exe
2456	perfCrt.exe
2456	perfCrt.exe
2456	perfCrt.exe
2456	perfCrt.exe
2456	perfCrt.exe
2456	perfCrt.exe
2456	perfCrt.exe
2456	perfCrt.exe
2456	perfCrt.exe
2456	perfCrt.exe
2456	perfCrt.exe
2456	perfCrt.exe
2456	perfCrt.exe
1852	services.exe
1852	services.exe
1852	services.exe
1852	services.exe
1852	services.exe
1852	services.exe
1852	services.exe
1852	services.exe
1852	services.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1852	services.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	perfCrt.exe
Token: SeDebugPrivilege	1852	services.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 4304	2928	c0bea0a11853ecbdd169b0d0a.exe	79
PID 2928 wrote to memory of 4304	2928	c0bea0a11853ecbdd169b0d0a.exe	79
PID 2928 wrote to memory of 4304	2928	c0bea0a11853ecbdd169b0d0a.exe	79
PID 4304 wrote to memory of 228	4304	WScript.exe	80
PID 4304 wrote to memory of 228	4304	WScript.exe	80
PID 4304 wrote to memory of 228	4304	WScript.exe	80
PID 228 wrote to memory of 2456	228	cmd.exe	82
PID 228 wrote to memory of 2456	228	cmd.exe	82
PID 2456 wrote to memory of 1852	2456	perfCrt.exe	135
PID 2456 wrote to memory of 1852	2456	perfCrt.exe	135
PID 1852 wrote to memory of 2876	1852	services.exe	136
PID 1852 wrote to memory of 2876	1852	services.exe	136
PID 1852 wrote to memory of 4380	1852	services.exe	137
PID 1852 wrote to memory of 4380	1852	services.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c0bea0a11853ecbdd169b0d0a.exe
"C:\Users\Admin\AppData\Local\Temp\c0bea0a11853ecbdd169b0d0a.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\8NQktCoAZviY5dhjarDv0yXqzR5kC.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\xpdAC628S.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Windows\perfCrt.exe
      "C:\Windows\perfCrt.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2456
    - - C:\odt\services.exe
        
        "C:\odt\services.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1852
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac94bb2e-5271-4578-95c5-41cc27c3b116.vbs"
        6⤵
        
        PID:2876
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5fad100c-a5a1-4b8c-b124-7eacd4fc6a2e.vbs"
        6⤵
        
        PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\Globalization\Sorting\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Globalization\Sorting\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\Globalization\Sorting\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Public\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Users\Default\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\schemas\Provisioning\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\schemas\Provisioning\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\schemas\Provisioning\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Libraries\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\odt\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "perfCrtp" /sc MINUTE /mo 11 /tr "'C:\Windows\Offline Web Pages\perfCrt.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "perfCrt" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\perfCrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "perfCrtp" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\perfCrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5fad100c-a5a1-4b8c-b124-7eacd4fc6a2e.vbs

Filesize
471B

MD5
d44a0d5049e4bb93de6b8ae80b1ea400

SHA1
20de60f1064befdb842472df134b8f1ab550d09f

SHA256
2e26bde836cd4719eeae7e93053596a1514c3eccba18d79ac3c5627a3c226672

SHA512
414525d4e4de823e58798d7956b80ce00c4b65ea8cc20436f0a95162eef8f8b33011f1a2e90379a9277b0e0cbfbc0931a8e0ddd918a4a47ab69408c44d969182

Download Submit
C:\Users\Admin\AppData\Local\Temp\ac94bb2e-5271-4578-95c5-41cc27c3b116.vbs

Filesize
695B

MD5
847773294562d2aed9dbb80592d3c508

SHA1
4e04c26157089ee901fa26561b3bda15ca5d678b

SHA256
458110326ed6eee2bf79c54cedf8212cb5cea995d0844812a1f8eb9abd45842f

SHA512
d5460ec9216fbcf61c95352690ff23120ebbef5ba1fcba25aba64cd9c4c6c10c359020ead9377fb371e3ffdb8de65f83a76004ec9707bd941c9cf1d5584fe719

Download Submit
C:\Windows\8NQktCoAZviY5dhjarDv0yXqzR5kC.vbe

Filesize
204B

MD5
bda4c38d73a75f19a5b0db1e6e0b7754

SHA1
19d73217e43de79c98a853e7b67705013578e348

SHA256
bd0bffa96bb67d96b7015d60cbb3bfaf64a7d1d8191e49fa17f7352a44058d4a

SHA512
743f332733bbf8cd9be78fd4a2e8879e1fb895c1c329b71edb2fc6756e021cfd746dcaa38d86cc5f007a1b0f08cf2c6fbc1b695a5f5520c8c67aca5e08d812e5

Download Submit
C:\Windows\Globalization\Sorting\dllhost.exe

Filesize
935KB

MD5
f553aaacd5d5d904ae5103a9f9d1d8e2

SHA1
29d46f0d7be8aaf8c9348d706395c5e5ad7095dd

SHA256
c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e

SHA512
d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b

Download Submit
C:\Windows\perfCrt.exe

Filesize
935KB

MD5
f553aaacd5d5d904ae5103a9f9d1d8e2

SHA1
29d46f0d7be8aaf8c9348d706395c5e5ad7095dd

SHA256
c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e

SHA512
d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b

Download Submit
C:\Windows\perfCrt.exe

Filesize
935KB

MD5
f553aaacd5d5d904ae5103a9f9d1d8e2

SHA1
29d46f0d7be8aaf8c9348d706395c5e5ad7095dd

SHA256
c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e

SHA512
d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b

Download Submit
C:\Windows\xpdAC628S.bat

Filesize
35B

MD5
7278c7ae6efbd4b50e3707c4dc4c608a

SHA1
c8e1db9b85f599c98b278571b147cf81fe2fbae4

SHA256
8f2fd99bb0dfa66ccca2c9173120318ea6702c64a5e112f63f9c2145ed9fe9dd

SHA512
d06d550b8eec81c4faa8aca795dea9aac748cf4ea8e4ce42bf73403f6f2be67616e2732ecdcf2eca390448c75a026b011aa2b8536a6fdcb4a07c12f71486049b

Download Submit
C:\odt\services.exe

Filesize
935KB

MD5
f553aaacd5d5d904ae5103a9f9d1d8e2

SHA1
29d46f0d7be8aaf8c9348d706395c5e5ad7095dd

SHA256
c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e

SHA512
d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b

Download Submit
C:\odt\services.exe

Filesize
935KB

MD5
f553aaacd5d5d904ae5103a9f9d1d8e2

SHA1
29d46f0d7be8aaf8c9348d706395c5e5ad7095dd

SHA256
c1452a47310558c9a70b6fd3b9d68156aad8c1b07fd53455bff0ccd83b95ba8e

SHA512
d7c11971125864dd2b746b22b01a15377569582185973c2f2c5e0300158ac0ee356c0dfb857edf93a6f2737ba9642448425c4c8329de99eaa6a43e796143d31b

Download Submit
memory/2456-145-0x00000000009E0000-0x0000000000AD2000-memory.dmp

Filesize
968KB

Download
memory/2456-150-0x000000001B7B0000-0x000000001B7C0000-memory.dmp

Filesize
64KB

Download